SCS-C02 Practice Test 48 — 15 Questions

Question 1

A security engineer is configuring a Network ACL for a public subnet that hosts a web server. The web server must accept HTTPS (TCP 443) traffic from the internet and respond. It must also be able to initiate outbound connections to the internet for software updates (HTTPS). What is the MINIMUM set of rules required for the inbound and outbound Network ACL?

Accepted Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 1024-65535 to 0.0.0.0/0 (for return traffic) and allow TCP 443 to 0.0.0.0/0 (for updates).. Option A is correct because inbound allows HTTPS from anywhere (0.0.0.0/0) and outbound allows ephemeral ports for return traffic and destination 0.0.0.0/0 for the outbound updates. Option B is wrong because it allows all inbound traffic. Option C is wrong because it allows all outbound traffic, which is not minimal but acceptable, but it also allows inbound SSH, which is not needed. Option D is wrong because it restricts outbound to only the update server, which may be too restrictive.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0 and TCP 22 from a management IP; Outbound: allow all traffic to 0.0.0.0/0.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow TCP 443 to a specific software update server IP.

Answer

Inbound: allow TCP 443 from 0.0.0.0/0; Outbound: allow all traffic to 0.0.0.0/0.

Question 2

A security engineer reviews the trust policy of an IAM role. Which accounts can assume this role?

Accepted Answer

Account 111111111111. Option B is correct because the principal is the root user of account 111111111111, meaning any IAM user or role from that account with sts:AssumeRole permission can assume the role. Option A is wrong because it's not any AWS account. Option C is wrong because only account 111111111111. Option D is wrong because the IAM user's root account is 111111111111, not 123456789012.

Answer

Only the root user of account 123456789012

Answer

Account 123456789012

Answer

Any AWS account

Question 3

A company has an EC2 instance that needs to access an S3 bucket. The security team wants to use the principle of least privilege. Which method should be used to grant access?

Accepted Answer

Create an IAM role with an S3 access policy and attach it to the EC2 instance profile.. Option D is correct because an IAM role assigned to the EC2 instance is the best practice. Option A is wrong because access keys stored on the instance are less secure. Option B is wrong because a bucket policy with a principal of the instance ID is not possible; bucket policies use IAM principals. Option C is wrong because security groups do not grant access to S3.

Answer

Use a security group to allow outbound traffic to S3.

Answer

Store AWS access keys on the instance and use them in the application.

Answer

Create a bucket policy that grants access to the EC2 instance ID.

Question 4

Which TWO are best practices for managing IAM roles for EC2 instances?

Accepted Answer

Apply the principle of least privilege when defining role permissions.. Using instance profiles with roles avoids long-term credentials. Rotating keys is for IAM users. Option C is correct for role assumption. Option D is correct for limiting permissions. Option E is not a best practice.

Answer

Regularly rotate IAM user access keys.

Answer

Attach the same role to all instances for simplicity.

Answer

Store AWS access keys directly on the instance.

Question 5

A Security Engineer needs to block SSH traffic (port 22) from the internet to all EC2 instances in a VPC. Which approach is the most secure and scalable?

Accepted Answer

Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.. Option A is correct because a network ACL at the subnet level blocks all traffic to port 22 from the internet before it reaches instances. Option B is wrong because you cannot deny rules in security groups; you can only allow. Option C is wrong because NACLs are stateless and require explicit outbound rules; however, the question asks to block inbound SSH, which a NACL can do. Option D is wrong because security groups are not applied at the VPC level.

Answer

Add a security group rule to deny inbound traffic on port 22 from 0.0.0.0/0.

Answer

Add a network ACL rule to allow inbound traffic on port 22 from 0.0.0.0/0 and then add a deny rule for the same traffic.

Answer

Add a security group rule to block inbound traffic on port 22 from 0.0.0.0/0 at the VPC level.

Question 6

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

Accepted Answer

Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway. Option D is correct because a NAT Gateway in a public subnet allows outbound internet access from private subnets while blocking inbound traffic. Option A is wrong because an internet gateway attached to the private subnet would allow inbound traffic. Option B is wrong because a bastion host is for SSH access, not for outbound internet. Option C is wrong because a VPC endpoint is for private connectivity to AWS services, not general internet.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it

Answer

Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

Answer

Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

Question 7

A security engineer notices that an EC2 instance in a private subnet can reach the internet, even though there is no NAT gateway or instance in the route table. What is the most likely cause?

Accepted Answer

An egress-only internet gateway is used for IPv6 traffic.. An egress-only internet gateway allows IPv6 traffic to the internet but not inbound. If the instance has an IPv6 address and the route table points to an egress-only internet gateway, it can reach the internet. Option D is correct. NAT gateways (A) are for IPv4. Internet gateway (B) would allow inbound. VPC endpoint (C) does not provide internet access.

Answer

An internet gateway is attached to the VPC and a default route points to it.

Answer

A VPC endpoint for S3 is configured.

Answer

A NAT gateway is configured in a different availability zone.

Question 8

Which AWS service can be used to centrally manage VPC security groups and network ACLs across multiple accounts in AWS Organizations?

Accepted Answer

AWS Firewall Manager. AWS Firewall Manager is the service for centrally managing security rules across accounts. Option C is correct. AWS Config (A) is for compliance, not management. AWS Shield (B) is for DDoS protection. AWS WAF (D) is for web application firewalls, not security groups.

Answer

AWS Shield

Answer

AWS Config

Answer

AWS WAF

Question 9

A company has a VPC with a public subnet and a private subnet. They launch an EC2 instance in the private subnet with a default security group that allows all outbound traffic. The instance needs to download files from an S3 bucket in the same region. Which configuration allows this without internet access?

Accepted Answer

Create a VPC gateway endpoint for S3 and add a route to the private subnet's route table.. A VPC gateway endpoint for S3 allows private instances to access S3 without internet. Option C is correct. NAT gateway (A) would require internet. Internet gateway (B) would expose instance. Direct Connect (D) is for on-premises.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet.

Answer

Create a NAT gateway in the public subnet and add a route to the private subnet's route table.

Question 10

A company uses AWS PrivateLink to connect to a SaaS provider's VPC endpoint service. The security team wants to ensure that traffic between the company's VPC and the SaaS provider's VPC is encrypted in transit and that no other AWS service can access the data. Which configuration meets these requirements?

Accepted Answer

Use an AWS PrivateLink endpoint (interface endpoint) in the company's VPC to connect to the SaaS provider's VPC endpoint service.. Option C is correct because PrivateLink uses AWS PrivateLink endpoints, which encrypt traffic within AWS and are isolated. Option A is wrong because VPC peering does not encrypt traffic by default. Option B is wrong because VPN is not needed. Option D is wrong because Transit Gateway is for routing, not encryption.

Answer

Use a Site-to-Site VPN connection between the VPC and the SaaS provider's on-premises network.

Answer

Create a VPC peering connection and use security groups to restrict traffic.

Answer

Use an AWS Transit Gateway with inter-region peering.

Question 11

A developer creates this CloudFormation stack. An EC2 instance with this role tries to list objects in the bucket. What will happen?

Accepted Answer

The instance can list the bucket but not the objects. Option A is correct because the policy only allows s3:ListBucket, which lists the bucket itself, not its objects. s3:ListObjects is required to list objects. Option B is wrong because s3:GetObject is for reading objects. Option C is wrong because s3:PutObject is for uploading. Option D is wrong because the role can assume.

Answer

The instance cannot assume the role because the principal is ec2.amazonaws.com

Answer

The instance can upload objects to the bucket

Answer

The instance can list objects in the bucket

Question 12

A company wants to enforce encryption in transit for all traffic between its VPC and on-premises data center over AWS Direct Connect. Which TWO configurations can achieve this?

Accepted Answer

Use a public virtual interface with Direct Connect and configure an IPsec VPN over it.. Option B (IPsec VPN over public VIF) and Option D (IPsec VPN over private VIF using Direct Connect Gateway) are correct. Option A is wrong because Direct Connect private virtual interface does not encrypt traffic by default. Option C is wrong because a Site-to-Site VPN over the internet does not use Direct Connect. Option E is wrong because Transit VPC is a network topology, not an encryption method.

Answer

Use a Site-to-Site VPN connection over the internet.

Answer

Use a Transit VPC architecture with VPN attachments.

Answer

Use a private virtual interface with Direct Connect.

Question 13

A company has multiple AWS accounts and wants to centralize VPC flow log analysis. Flow logs are enabled for all VPCs and are published to Amazon S3 buckets in each account. A security engineer needs to aggregate these logs into a single S3 bucket in the centralized logging account. What should the security engineer do?

Accepted Answer

Create an S3 bucket policy on the centralized bucket that allows the source accounts to write objects.. Option D is correct because S3 bucket policies can be used to grant cross-account permissions. Option A is wrong because VPC peering does not allow cross-account S3 access. Option B is wrong because CloudWatch Logs can route to S3 but requires additional configuration. Option C is wrong because S3 replication automatically copies objects but requires source and destination buckets in different accounts with proper permissions.

Answer

Set up VPC peering between each account and the centralized logging account, then configure flow logs to write directly to the centralized bucket.

Answer

Configure S3 Replication between each account's flow log bucket and the centralized bucket.

Answer

Use Amazon CloudWatch Logs to stream flow logs to the centralized S3 bucket.

Question 14

A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.. Option C is correct because VPC endpoints for S3 and DynamoDB are for specific services, not general internet access. Option A is wrong because a NAT gateway requires an internet gateway and a route to the internet. Option B is wrong because a proxy would still need outbound internet access. Option D is correct because a VPC interface endpoint for AWS Systems Manager allows outbound-only communication to download patches without internet access.

Answer

Launch a proxy server in a public subnet and configure the application to use the proxy.

Answer

Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.

Answer

Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.

Question 15

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no resources can be created in a specific AWS Region except for the us-east-1 Region. Which policy type should the security team use?

Accepted Answer

Service control policy (SCP). Option A is correct because SCPs can restrict actions at the account level. Option B is wrong because IAM policies apply to users/roles, not accounts. Option C is wrong because resource-based policies apply to specific resources. Option D is wrong because service control policies are the correct mechanism, not IAM permissions boundaries.

Answer

IAM permissions boundary

Answer

IAM policy applied to the root user

Answer

Resource-based policy